# US 11,115,282 B2 · Apparatus and measurement method for identifying network devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,282 B2 - Document ID: US11115282B2 - Status: Granted - Kind: B2 - Application number: 16/219,459 - Filed: 2018-12-13 - Published: 2019-06-20 - Granted: 2021-09-07 - Earliest claimed: 2017-12-15 - Assignees: Rohde & Schwarz GmbH & Co. KG - Applicants: Rohde & Schwarz GmbH & Co. KG - Inventors: Jörg Weide; Jens Geier; Daniel Schmidt; Sebastian Spieß; Bernd Buschinski - Web page: https://patentgrep.com/patent/US11115282B2 ## CPC - H04L 41/142: using statistical or mathematical methods - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0853: by actively collecting configuration information or by backing up configuration information - H04L 41/0869: Validating the configuration within one network element - H04L 43/028: by filtering - H04L 61/2514: between local and global IP addresses - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 67/303: Terminal profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An apparatus for identifying network devices comprises a data acquisition unit that receives data from a multiplicity of network devices. It also comprises an interpretation unit that extracts identification data from the data and determines which of the multiplicity of network devices has sent the received data. A similarity of measured data of a physical clock to a predefined pattern and/or to previously measured data of the physical clock is analysed as a first criterion of an association of received data. In addition, at least one further criterion of an association of received data can be analysed among the identification data. ## Claims ### Claim 1 An apparatus for identifying network devices in a communications network without using explicit identification information of the network devices, the apparatus comprising: a processor; and memory comprising software, which when executed by the processor, implements: a data acquirer configured to receive data from a plurality of network devices in the communications network; and an interpreter configured to: extract identification data from the data, the identification including information from which the identity of the network devices may be inferred; analyse the extracted identification data by: analysing as a first criterion of a group of criteria an association of the identification data with one or more specific network devices to identify at least one of a similarity of measured data of a physical clock of the network devices to a predefined pattern and/or to previously measured data of the physical clock of the network devices, and analysing one or more further criterion of the group of criteria to identify additional associations of the identification data with the one or more specific network devices based on traffic information; determine, based on the results of the analyzing of the first criterion and the one or more further criterion, which of the plurality of network devices has sent the received data; evaluating the results of the analysing to provide feedback to a user by: determining, for each network device identified on the basis of the criteria, a separate confidence value for each criterion, determining for each identified network device an overall confidence value from the confidence values of all the analysed criteria, and determining the overall confidence value by forming an arithmetic mean, by forming a median, by forming a geometric mean, by forming a harmonic mean, by forming a quadratic mean, or by forming a cubic mean from the confidence values of the individual criteria; and providing the overall confidence value to the user. ### Claim 2 (depends on 1) The apparatus according to claim 1, wherein the interpreter is configured to determine the separate confidence value for each of the criteria by ascertaining a similarity or a match of the analysed criterion to an ideal value of the analysed criterion in question. ### Claim 3 (depends on 1) The apparatus according to claim 1, wherein the apparatus also comprises a display device, wherein the display device is configured to display the identified network devices, and wherein the display device is configured to display the overall confidence value. ### Claim 4 (depends on 1) The apparatus according to claim 1, wherein the apparatus comprises a display device, wherein the display device is configured to display the identified network devices, and wherein the display device is configured to display for each identified network device separate confidence value for each criterion or the overall confidence value for each analysed criterion. ### Claim 5 (depends on 1) The apparatus according to claim 1, wherein the interpreter is configured to detect an association of received data with a specific, already identified network device: when all the analysed criteria exhibit a similarity above a predefined similarity threshold value or exhibit a match, or when a majority of all the analysed criteria exhibit a similarity above a predefined similarity threshold value or exhibit a match, or when at least a predefined number of analysed criteria exhibit a similarity above a predefined similarity threshold value or exhibit a match. ### Claim 6 (depends on 5) The apparatus according to claim 5, wherein the interpreter is configured to identify a new network device when all the analysed criteria exhibit a similarity below a predefined similarity threshold value or do not exhibit a match with any of the already identified network devices, when a majority of all the analysed criteria do not exhibit a similarity above a predefined similarity threshold value or do not exhibit a match, or when a predefined number of analysed criteria exhibit a similarity above a predefined similarity threshold value or exhibit a match. ### Claim 7 (depends on 1) The apparatus according to claim 1, wherein the interpreter is configured to analyse one or more additional criterion selected from: a similarity of IP fragment identifiers, a similarity of TCP timestamps, a match of IMSI numbers, a match of IMEI numbers, a match of ISDN numbers, a match of mobile device identifiers in HTTP traffic, a similarity of advertising identifiers, a match of tracking cookies in HTTP traffic, a similarity of DNS profiles, a similarity of user agent patterns, or activity phases and inactivity phases within the data from network devices. ### Claim 8 (depends on 1) The apparatus according to claim 1, wherein the interpreter is configured to analyse at least two additional criteria among the identification data. ### Claim 9 (depends on 1) The apparatus according to claim 1, wherein each network device identified comprises multi-stack network devices, or wherein each network device identified is arranged within the communications network behind at least one NAT router from the viewpoint of the apparatus. ### Claim 10 (depends on 1) The apparatus according to claim 1, wherein the plurality of network devices use different network addresses at different times. ### Claim 11 (depends on 2) The apparatus according to claim 2, wherein each network device identified runs programs, wherein the programs each produce program data as part of the data sent by the network device, and wherein the interpreter is configured to use activity phases and inactivity phases within the data from a network device to distinguish between program data from different programs of the network device. ### Claim 12 (depends on 11) The apparatus according to claim 11, wherein the interpreter is configured to identify the programs of the network devices on the basis of the program data. ### Claim 13 A measurement method for identifying network devices in a communications network without using explicit identification information of the network devices, the method comprising: receiving data from a plurality of network devices in the communications network; and extracting identification data from the data, the identification including information from which the identity of the network devices may be inferred; analysing the extracted identification data by: analysing as a first criterion of a group of criteria an association of the identification data with one or more specific network devices to identify at least one of a similarity of measured data of a physical clock of the network devices to a predefined pattern and/or to previously measured data of the physical clock of the network devices, and analysing one or more further criterion of the group of criteria to identify additional associations of the identification data with the one or more specific network devices based on traffic information; determining, based on the results of the analyzing of the first criterion and the one or more further criterion, which of the plurality of network devices has sent the received data; evaluating the results of the analysing to provide feedback to a user by: determining, for each network device identified on the basis of the criteria, a separate confidence value for each criterion, determining for each identified network device an overall confidence value from the confidence values of all the analysed criteria, and determining the overall confidence value by forming an arithmetic mean, by forming a median, by forming a geometric mean, by forming a harmonic mean, by forming a quadratic mean, or by forming a cubic mean from the confidence values of the individual criteria; and providing the overall confidence value to the user.